新CrackMe160之017 - Cabeca

与旧程序021相同

1. 暴力破解, OD打开搜索框找到报错信息定位到0042D42C, 向上看一大堆的跳, 找到最上面一个0042D3E5先下个断点, 然后住下找到成功分支0042D4D6记录起来, 回到0042D3E5, 将je 改为 jmp 0042D4D6, 保存, 暴破完成

2. 正常破解, 三处分别输入a, b, c, 点try, 单步往下执行, 其中看到了1063和121两个值 , 故, 把b, c对应改了, 结果成功了
   name: a, Serial 1: 1063, Serial 2: 121, 具体算法是什么呢, 我们继续跟进, 跟踪发现1063来自内存0x42F714, 说明这是一个程序变量, 我们换一个Name值, 发现这个内存值也会变, 说明Name输入框应该有key change事件, 去改变这个变量值, 我们需要找到这个key change事件, 才能知道具体算法, 程序是Delphi写的, 我们用Delphi Decompiler分析一下, 看到事件中果然有个Edit1KeyPress事件, 入口是0042CE30, ok, 我们在OD中定位,
   ctrl+g输入0042CE30, 具体程序是, edx = edx + -8; (a=0x61, -0x8 = 0x59), if(edx > 0x72){ return }else{ dl=1, 0x42F714 += 0x427, 0x42F718 += 0x79, return }, 看到了这个0x427吗? 10进制就是1063, 第二个0x79, 就是121, 看来第三个值也是从这里算出来的, 接着我们试一下输别的值, 我们发现+的内容变化了, 跳到了另一个地址, 关键是这个[edx*4+0x42CEC0], 就是根据输入的值跳转到对应的位置, 这个就是程序是swith或if的写法, 跟踪发现+的值没什么规律, 那就按作者的一个个列出来吧, 只能这样了, 允许输入的有效字符是a_zAZ, 其它字符不参与计算, 所以输入a1, 等同于只输入了a, Serial1, Serial2的结果不变, 都是1063与121

到此, 算法解读完成了, 下面开始写注册机: (KeyGen.c)

#include <iostream>
#include "string.h"

int main(){
	while(true){
		long long rlt1 = 0;
		long long rlt2 = 0;
		char user[20] = {0};
		printf("请输入用户名: ");
		scanf("%s", user);
		int len = strlen(user);
		int asc = 0; 
		for(int i=0; i<len; i++){
			asc = user[i];
			if(asc - 8 > 0x72){ continue; }
			switch(asc){ //a~zA~Z
				case(0x61):{rlt1 += 0x427; 	rlt2 += 0x79; 		break;}
				case(0x62):{rlt1 += 0x6BC; 	rlt2 += 0x6F; 		break;}
				case(0x63):{rlt1 += 0x491; 	rlt2 += 0x2E2; 		break;}
				case(0x64):{rlt1 += 0x474D; 	rlt2 += 0x2FA; 	break;}
				case(0x65):{rlt1 += 0x400; 	rlt2 += 0xE; 		break;}
				case(0x66):{rlt1 += 0x6D0; 	rlt2 += 0xD; 		break;}
				case(0x67):{rlt1 += 0x67D; 	rlt2 += 0xC; 		break;}
				case(0x68):{rlt1 += 0x750; 	rlt2 += 0xB; 		break;}
				case(0x69):{rlt1 += 0x43C; 	rlt2 += 0x63; 		break;}
				case(0x6A):{rlt1 += 0x764; 	rlt2 += 0x378; 		break;}
				case(0x6B):{rlt1 += 0xC0; 	rlt2 += 0x4D; 		break;}
				case(0x6C):{rlt1 += 0x277D; 	rlt2 += 0x22B; 	break;}
				case(0x6D):{rlt1 += 0x81E; 	rlt2 += 0x5A; 		break;}
				case(0x6E):{rlt1 += 0xE07; 	rlt2 += 0x62; 		break;}
				case(0x6F):{rlt1 += 0x8E; 	rlt2 += 0x1D2C; 	break;}
				case(0x70):{rlt1 += 0x9A670; 	rlt2 += 0x8C7F3; 	break;}
				case(0x71):{rlt1 += 0xD57; 	rlt2 += 0x288; 		break;}
				case(0x72):{rlt1 += 0x5FEB; 	rlt2 += 0x21A; 	break;}
				case(0x73):{rlt1 += 0x8B0; 	rlt2 += 0x1; 		break;}
				case(0x74):{rlt1 += 0x4BB; 	rlt2 += 0x40; 		break;}
				case(0x75):{rlt1 += 0x8C2; 	rlt2 += 0x4B; 		break;}
				case(0x76):{rlt1 += 0x1CA6; 	rlt2 += 0x4E; 		break;}
				case(0x78):{rlt1 += 0x395; 	rlt2 += 0x26; 		break;}
				case(0x77):{rlt1 += 0x251E; 	rlt2 += 0x5; 		break;}
				case(0x79):{rlt1 += 0x2D13;	rlt2 += 0x8; 		break;}
				case(0x7A):{rlt1 += 0x1900; 	rlt2 += 0x1C8; 	break;}
				case(0x41):{rlt1 += 0x428; 	rlt2 += 0x1610; 	break;}
				case(0x42):{rlt1 += 0xB1630; 	rlt2 += 0x2; 		break;}
				case(0x43):{rlt1 += 0xD86; 	rlt2 += 0x270F; 	break;}
				case(0x44):{rlt1 += 0x11A4; 	rlt2 += 0x46FF33C; 	break;}
				case(0x45):{rlt1 += 0x11F0A; 	rlt2 += 0x8B3C; 	break;}
				case(0x46):{rlt1 += 0x3CC2; 	rlt2 += 0x8618; 	break;}
				case(0x47):{rlt1 += 0x3E1A8; 	rlt2 += 0x6C81C; 	break;}
				case(0x48):{rlt1 += 0x91E4; 	rlt2 += 0x27E945; 	break;}
				case(0x49):{rlt1 += 0x6B42; 	rlt2 += 0x2FC7C3; 	break;}
				case(0x4A):{rlt1 += 0x516A4; 	rlt2 += 0xB8F47C; 	break;}
				case(0x4B):{rlt1 += 0x4345A; 	rlt2 += 0x115C7; 	break;}
				case(0x4C):{rlt1 += 0x1BFDD9; rlt2 += 0x12B54; 	break;}
				case(0x4D):{rlt1 += 0x286D; 	rlt2 += 0xB348C; 	break;}
				case(0x4E):{rlt1 += 0x401; 	rlt2 += 0x357CE174; break;}
				case(0x4F):{rlt1 += 0x674; 	rlt2 += 0x317CD7; 	break;}
				case(0x50):{rlt1 += 0x9C; 	rlt2 += 0x7DD834; 	break;}
				case(0x51):{rlt1 += 0x156; 	rlt2 += 0x39CD0; 	break;}
				case(0x52):{rlt1 += 0x8627; 	rlt2 += 0xBF44A; 	break;}
				case(0x53):{rlt1 += 0x748190; rlt2 += 0x854686; 	break;}
				case(0x54):{rlt1 += 0xA568; 	rlt2 += 0x13220; 	break;}
				case(0x55):{rlt1 += 0x15592; 	rlt2 += 0x302E; 	break;}
				case(0x56):{rlt1 += 0x1DD9; 	rlt2 += 0x1C43; 	break;}
				case(0x58):{rlt1 += 0x266A; 	rlt2 += 0x2BA96C08; break;}
				case(0x57):{rlt1 += 0x3CC0; 	rlt2 += 0x4EFC8; 	break;}
				case(0x59):{rlt1 += 0x8311; 	rlt2 += 0x1C46; 	break;}
				case(0x5A):{rlt1 += 0xCE1B; 	rlt2 += 0xB1664; 	break;}
			}
		}
		printf("系列号1为: %lld\n系列号2为: %lld\n", rlt1, rlt2);
	}
	return 0;
}

运行示例:
请输入用户名: Cabeca
系列号1为: 9505
系列号2为: 11104

 
 
本节高手录制的视频,点击前往查看

 
 
 

使用的工具连接(工具有点多有点大,可以先下OD,其它的后面慢慢下) 点击前往下载

下面是我的OD的界面布局,我觉得这4个是最常用的界面,其它的我基本上没用到~